s
This commit is contained in:
Your Name
parent
abb97b036d
commit
77bd3d8430
116
firewall.sh
116
firewall.sh
@ -5,7 +5,7 @@ SERVER_IP='192.168.0.55'
|
||||
NGINX_ACCESS="/tmp/access.log"
|
||||
#Firewall Port Configuration
|
||||
#
|
||||
declare -A portConfig
|
||||
declare -A portConfig
|
||||
portConfig["https"]="443"
|
||||
portConfig["http"]="80"
|
||||
portConfig["cups"]="631"
|
||||
@ -46,7 +46,7 @@ VIRT_BRIDGE="virbr0"
|
||||
NFT='/usr/bin/nft'
|
||||
NFT_CACHE='/tmp/nft.cache'
|
||||
TMP_BLOCK=($(redis-cli --raw SMEMBERS tmp_block))
|
||||
#Log Files
|
||||
#Log Files
|
||||
#
|
||||
SAVED_BOTS=($(redis-cli --raw SMEMBERS bots))
|
||||
CRAWLER_DB=($(redis-cli --raw SMEMBERS crawlers))
|
||||
@ -66,32 +66,32 @@ COUNTRY=(
|
||||
https://www.ipdeny.com/ipblocks/data/countries/cn.zone
|
||||
)
|
||||
|
||||
ipBlockParser(){
|
||||
if [[ "$1" == *":"* ]]; then
|
||||
$NFT insert rule ip6 filter input position 0 ip6 saddr $1 drop
|
||||
else
|
||||
$NFT insert rule ip filter input position 0 ip saddr "$1" drop
|
||||
fi
|
||||
ipBlockParser() {
|
||||
if [[ "$1" == *":"* ]]; then
|
||||
$NFT insert rule ip6 filter input position 0 ip6 saddr $1 drop
|
||||
else
|
||||
$NFT insert rule ip filter input position 0 ip saddr "$1" drop
|
||||
fi
|
||||
}
|
||||
|
||||
portOpenParser(){
|
||||
if [[ "$1" == "443" || "$1" == "80" ]]; then
|
||||
$NFT add rule ip filter input ct state new tcp dport $1 update @http_ratelimit { ip saddr limit rate 10/second } accept
|
||||
$NFT add rule ip6 filter input ct state new tcp dport $1 update @http_ratelimit { ip6 saddr limit rate 10/second } accept
|
||||
else
|
||||
$NFT add rule ip filter input position 0 tcp dport $1 accept
|
||||
$NFT add rule ip filter input position 0 udp dport $1 accept
|
||||
$NFT add rule ip6 filter input position 0 tcp dport $1 accept
|
||||
$NFT add rule ip6 filter input position 0 udp dport $1 accept
|
||||
fi
|
||||
portOpenParser() {
|
||||
if [[ "$1" == "443" || "$1" == "80" ]]; then
|
||||
$NFT add rule ip filter input ct state new tcp dport $1 update @http_ratelimit { ip saddr limit rate 10/second } accept
|
||||
$NFT add rule ip6 filter input ct state new tcp dport $1 update @http_ratelimit { ip6 saddr limit rate 10/second } accept
|
||||
else
|
||||
$NFT add rule ip filter input position 0 tcp dport $1 accept
|
||||
$NFT add rule ip filter input position 0 udp dport $1 accept
|
||||
$NFT add rule ip6 filter input position 0 tcp dport $1 accept
|
||||
$NFT add rule ip6 filter input position 0 udp dport $1 accept
|
||||
fi
|
||||
}
|
||||
|
||||
ipDeleteParser(){
|
||||
if [[ "$1" == *":"* ]]; then
|
||||
$NFT delete rule ip6 filter input handle $HANDLE
|
||||
else
|
||||
$NFT delete rule ip filter input handle $HANDLE
|
||||
fi
|
||||
ipDeleteParser() {
|
||||
if [[ "$1" == *":"* ]]; then
|
||||
$NFT delete rule ip6 filter input handle $HANDLE
|
||||
else
|
||||
$NFT delete rule ip filter input handle $HANDLE
|
||||
fi
|
||||
}
|
||||
|
||||
blockCountry() {
|
||||
@ -142,7 +142,6 @@ bot-search() {
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
basic-security() {
|
||||
$NFT flush ruleset
|
||||
$NFT -f /opt/firewall/ipv4-filter.nft
|
||||
@ -153,8 +152,8 @@ basic-security() {
|
||||
$NFT insert rule filter input ct state established accept
|
||||
$NFT insert rule filter input iif lo accept
|
||||
|
||||
for i in "${!portConfig[@]}"; do
|
||||
echo "Enabling Port for: $i"
|
||||
for i in "${!portConfig[@]}"; do
|
||||
echo "Enabling Port for: $i"
|
||||
portOpenParser "${portConfig[$i]}"
|
||||
|
||||
done
|
||||
@ -181,11 +180,10 @@ trust() {
|
||||
import-saved() {
|
||||
|
||||
for i in "${SAVED_BOTS[@]}"; do
|
||||
ipBlockParser $i
|
||||
ipBlockParser $i
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
start() {
|
||||
basic-security
|
||||
|
||||
@ -195,8 +193,8 @@ start() {
|
||||
blockCountry
|
||||
wireguard-networking
|
||||
docker restart uptime-kuma
|
||||
|
||||
#Docker
|
||||
|
||||
#Docker
|
||||
$NFT insert rule filter input iif docker0 accept
|
||||
else
|
||||
virtualization
|
||||
@ -204,7 +202,7 @@ start() {
|
||||
}
|
||||
|
||||
research() {
|
||||
STATS=($(redis-cli --raw SMEMBERS tmp_block | sort -u))
|
||||
STATS=($(redis-cli --raw SMEMBERS tmp_block | sort -u))
|
||||
for i in "${STATS[@]}"; do
|
||||
echo $MENU_TOP
|
||||
echo " [Researching $i] "
|
||||
@ -233,7 +231,7 @@ status() {
|
||||
NOT_FOUND=$(grep $DATE $NGINX_ACCESS | grep -vi $MY_IP | grep 404 | wc -l)
|
||||
GATEWAY=$(grep $DATE $NGINX_ACCESS | grep -vi $MY_IP | grep 502 | wc -l)
|
||||
SUCCESS=$(grep $DATE $NGINX_ACCESS | grep -vi $MY_IP | grep 200 | wc -l)
|
||||
CRAWL=$(grep $DATE $NGINX_ACCESS | grep -vi $MY_IP | grep -Fivf <(printf '%s\n' "${CRAWLER_DB[@]}") | wc -l)
|
||||
CRAWL=$(grep $DATE $NGINX_ACCESS | grep -vi $MY_IP | grep -Fivf <(printf '%s\n' "${CRAWLER_DB[@]}") | wc -l)
|
||||
echo $MENU_TOP
|
||||
echo "Attack Threshold: $ATTACK_THRESHOLD"
|
||||
echo "Firewall Rules: $($NFT list table filter | wc -l)"
|
||||
@ -299,20 +297,19 @@ module-go() {
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
module-akkoma() {
|
||||
SEARCH_SPAM=$(grep $2 $NGINX_ACCESS | grep -E "api/v1/instance|api/v1/notifications|api/v1/accounts|api/v2/search|timelines/public|timelines/home|/api/v1/accounts" | grep $1 | wc -l)
|
||||
CHECK=$(cat $NFT_CACHE | sort -u | grep $i)
|
||||
if [[ "$SEARCH_SPAM" -gt 30 ]]; then
|
||||
echo "$IP $CHECK $COUNT"
|
||||
if [ "$CHECK" = "" ]; then
|
||||
ipBlockParser "$1"
|
||||
redis-cli SADD tmp_block $i
|
||||
message "module-akkoma: Spam Attack! $i"
|
||||
echo "module-akkoma: Spam $1"
|
||||
else
|
||||
echo "module-akkoma: Ignoring Duplicate IP: $i"
|
||||
fi
|
||||
echo "$IP $CHECK $COUNT"
|
||||
if [ "$CHECK" = "" ]; then
|
||||
ipBlockParser "$1"
|
||||
redis-cli SADD tmp_block $i
|
||||
message "module-akkoma: Spam Attack! $i"
|
||||
echo "module-akkoma: Spam $1"
|
||||
else
|
||||
echo "module-akkoma: Ignoring Duplicate IP: $i"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
@ -350,8 +347,8 @@ message() {
|
||||
watch() {
|
||||
echo "Scanning $DATE"
|
||||
echo
|
||||
IP=($(grep $DATE $NGINX_ACCESS | grep -Fivf <(printf '%s\n' "${SAFE_TRAFFIC[@]}") | grep -Fivf <(printf '%s\n' "${CRAWLER_DB[@]}") | grep -Fivf <(printf '%s\n' "${SAVED_BOTS[@]}")| grep -vi $MY_IP | grep -vi '127.0.0.1' | cut -d ' ' -f1 | sort -u))
|
||||
|
||||
IP=($(grep $DATE $NGINX_ACCESS | grep -Fivf <(printf '%s\n' "${SAFE_TRAFFIC[@]}") | grep -Fivf <(printf '%s\n' "${CRAWLER_DB[@]}") | grep -Fivf <(printf '%s\n' "${SAVED_BOTS[@]}") | grep -vi $MY_IP | grep -vi '127.0.0.1' | cut -d ' ' -f1 | sort -u))
|
||||
|
||||
for i in "${IP[@]}"; do
|
||||
module-akkoma "$i" "$DATE"
|
||||
module-lightning "$i" "$DATE"
|
||||
@ -382,11 +379,11 @@ watch() {
|
||||
done
|
||||
}
|
||||
|
||||
module-nostr(){
|
||||
IP=($(grep $DATE $NGINX_ACCESS | grep "/block=" | cut -d '=' -f2| cut -d ' ' -f1 | sed 's/"//'))
|
||||
module-nostr() {
|
||||
IP=($(grep $DATE $NGINX_ACCESS | grep "/block=" | cut -d '=' -f2 | cut -d ' ' -f1 | sed 's/"//'))
|
||||
for i in "${IP[@]}"; do
|
||||
echo $i
|
||||
if [[ "$i" == *"npub"* ]]; then
|
||||
echo $i
|
||||
if [[ "$i" == *"npub"* ]]; then
|
||||
bash /opt/strfry-policies/block.sh $i
|
||||
else
|
||||
echo "No Npubs to block"
|
||||
@ -410,7 +407,7 @@ test-bots() {
|
||||
research-ip() {
|
||||
echo "Enter an IP Address to search"
|
||||
read -p 'IP Address: ' -e IP
|
||||
cat $NGINX_ACCESS | grep $IP
|
||||
cat $NGINX_ACCESS | grep $IP
|
||||
echo
|
||||
read -p 'Press Enter to Continue ' -e
|
||||
}
|
||||
@ -471,19 +468,22 @@ menu() {
|
||||
menu
|
||||
}
|
||||
|
||||
importDB(){
|
||||
DATA=($(cat safe.txt));for i in "${DATA[@]}"; do redis-cli SADD safe_traffic $i;done
|
||||
DATA=($(cat bots.txt));for i in "${DATA[@]}"; do redis-cli SADD bots $i;done
|
||||
DATA=($(cat crawlers.txt));for i in "${DATA[@]}"; do redis-cli SADD crawlers $i;done
|
||||
importDB() {
|
||||
DATA=($(cat safe.txt))
|
||||
for i in "${DATA[@]}"; do redis-cli SADD safe_traffic $i; done
|
||||
DATA=($(cat bots.txt))
|
||||
for i in "${DATA[@]}"; do redis-cli SADD bots $i; done
|
||||
DATA=($(cat crawlers.txt))
|
||||
for i in "${DATA[@]}"; do redis-cli SADD crawlers $i; done
|
||||
}
|
||||
|
||||
exportDB(){
|
||||
exportDB() {
|
||||
rm -f crawlers.txt
|
||||
rm -f bots.txt
|
||||
rm -f safe.txt
|
||||
for i in "${CRAWLER_DB[@]}"; do echo $i >> crawlers.txt;done
|
||||
for i in "${SAVED_BOTS[@]}"; do echo $i >> bots.txt;done
|
||||
for i in "${SAFE_TRAFFIC[@]}"; do echo $i >> safe.txt;done
|
||||
for i in "${CRAWLER_DB[@]}"; do echo $i >>crawlers.txt; done
|
||||
for i in "${SAVED_BOTS[@]}"; do echo $i >>bots.txt; done
|
||||
for i in "${SAFE_TRAFFIC[@]}"; do echo $i >>safe.txt; done
|
||||
}
|
||||
|
||||
if [ "$1" = "start" ]; then
|
||||
|
||||
Loading…
Reference in New Issue
Block a user